MalwareIntelligence is a site dedicated to research on all matters relating to anti-malware security, criminology computing and information security in general, always from a perspective closely related to the field of intelligence.

1.10.10

PEK (Phoenix Exploit's Kit) has become one of the most used by those who flood the Internet every day with different types of malicious code. Currently, a large amount of malware is distributed through this crimeware, which is also widely used for collecting information relevant to a botmaster.

Earlier we mentioned how it looks inside version 2.1 and at the same time we said that from the standpoint of design, different versions of PEK are practically very similar, with the typical dark background, the phoenix in the lower right corner and facing your authentication system trivial at first glance, but nevertheless performs a check under the SHA1 algorithm.

This time, it's version 2.3 of PEK, the final and stable so far (there is a preliminary version 2.4 known as the 2.3r). However, despite no visible differences appear, this version also upgrade a number of "details" in your code, incorporates a number of exploits which currently represent the highest success rate.

Simple statisticsDisplays information about the general data tones to the recorded information with PEK.

Their "sale" began in early July 2010 at a cost of $ 2200. An interesting detail is what the sentence is shown with the logo: "CONCORDIA, INTEGRITAS, INDUSTRIA…" three Latin words which are closely related to a famous German family. His translation is harmony, integrity and diligence.

Regarding the spread executable binary, in this case, it's a variant of the trojan generated with the private constructor SpyEye: